Phishing detection: netflixama111.com

Netflix
https://netflixama111.com Access site
Screenshot
Screenshot of netflixama111.com
Investigate
Domain netflixama111.com1 CT host on apex
urlscan page.domain VirusTotal Whois

See every phishunt record for this domain

IP 104.21.58.241
urlscan page.ip VirusTotal ipinfo Greynoise
URL https://netflixama111.com
urlscan Wayback archive.today
Cert Google Trust Services
crt.sh Censys Google CT
Phishunt analysis Beta
32 medium suspicion suspiciousheuristic risk score · not a probability
Why?
  • +5.3 Keyword match
  • +5.1 Site cluster
  • +5.1 urlscan.io
  • +4.1 Brand in screenshot
  • +3.7 Brand in domain label
  • +2.0 Young domain
  • +1.9 ASN reputation
  • +1.1 No CSP header
  • +0.9 Young certificate
  • +0.9 No registrar lock
  • +0.7 Brand in cert SAN
  • +0.6 Registrar reputation
  • +0.3 Free CA
  • +0.3 Long domain
  • +0.2 Suspicious TLD
18 signals fired · detector v3.0.0
AI analysis AIBeta
Credential harvesting

Impersonates Netflix on a standalone domain with numeric padding, hosted behind Cloudflare to obscure the real server; confirmed malicious by urlscan and part of a known phishing cluster, likely targeting streaming account credentials.

Brand in domain labelurlscan.ioSite cluster
AI-generated from stored detector signals - the AI never visited the site. · 2026-07-22 · confidence 72%
Domain & Network
Whois
Registrar Hosting Concepts B.V. d/b/a Registrar.eu
Network
IP 104.21.58.241
Country United StatesUnited States
Hosting Cloudflare, Inc.
ASN AS13335
TLS Cert Google Trust Services
External detection urlscan.io
CleanGoogle Safe Browsing · OpenPhish · PhishTank · TweetFeed
Report this phishing
Network / ASN Cloudflare, Inc.
Web form
Brand owner Netflix
phishing@netflix.com
Submit to blocklists
Google Safe Browsing Microsoft SmartScreen APWG PhishTank
Not phishing? Dispute this detection

Tracked from 2026-07-19 22:32 UTC  ·  Last refreshed 2026-08-31 09:30 UTC